By default, vCenter Server notifies you 30 days before your Key Management Server (KMS) certificates expire. You can change this default value.

KMS certificates have an expiration date. When the threshold for the expiration date is reached, an alarm notifies you.

vCenter Server and KMS clusters exchange two types of certificates: server and client. The VMware Endpoint Certificate Store (VECS) on the vCenter Server system stores the server certificates and one client certificate per KMS cluster. Because there are two certificate types, there are two alarms for each certificate type (one for client, one for server).


  1. Log in to the vSphere Web Client, and select a vCenter Server system.
  2. Click the Configure tab.
  3. Under Settings, click Advanced System Settings, and click Edit.
  4. Either filter for, or scroll to the vpxd.kmscert.threshold configuration parameter.
  5. Enter your value in days and click OK.